# TrueNAS connection
TRUENAS_HOST=192.168.10.10
SSH_USER=youruser

# VM identity / networking
VM_NAME=scrypted
# Static IP OUTSIDE the Fritzbox DHCP pool (.20-.200) AND not already taken by
# another device — verify with `ping`/`arp` first. .12/.13/.14 are occupied
# here (.13 is the Music Assistant VM), so we use .15. Must be on the same flat
# LAN as your cameras (no VLAN) for mDNS/SSDP discovery and HomeKit.
VM_IP=192.168.10.15
VM_SUBNET_CIDR=24
VM_GATEWAY=192.168.10.1
# DNS for the VM. Point it at your AdGuard jail (dogfooding) + a public fallback.
VM_DNS=192.168.10.11
VM_DNS_FALLBACK=1.1.1.1
# Physical NIC the VM attaches to (TrueNAS bridges it automatically). Must be the
# LAN interface that carries the NAS IP. On this box: igb0 (em0 is down).
# Find valid values: GET /api/v2.0/vm/device/nic_attach_choices
VM_NIC_ATTACH=igb0

# VM resources. Scrypted does camera decode/transcode, so give it more than a
# lightweight service (4 vCPUs, 4 GB RAM, 40 GB disk).
VM_VCPUS=4
VM_MEMORY_MB=4096
VM_DISK_SIZE=40G
VM_TIMEZONE=Europe/Berlin

# Storage on the NAS. VM_DATASET holds the zvol, seed ISO and image cache.
VM_POOL=tank
VM_DATASET=tank/vms

# Images
# Debian 13 "trixie" genericcloud raw image (no qemu-img needed). Check for newer point releases.
DEBIAN_IMAGE_URL=https://cloud.debian.org/images/cloud/trixie/latest/debian-13-genericcloud-amd64.raw
SCRYPTED_IMAGE=ghcr.io/koush/scrypted:latest

# VM login user (for the serial console, `logs`/`update` over SSH).
VM_USER=admin
# Console/SSH password for VM_USER. Used by the TrueNAS serial console and as an
# SSH fallback when the key isn't available. CHANGE THIS from the default.
VM_PASSWORD=changeme
# Your SSH PUBLIC key for the VM login (strongly recommended; required for
# `logs`/`update`). Example: VM_SSH_AUTHORIZED_KEY="ssh-ed25519 AAAA... you@host"
VM_SSH_AUTHORIZED_KEY=

# --- Optional: migrate existing Scrypted state from Home Assistant ----------
# Only needed for `./setup-scrypted-vm.sh migrate`. Leave blank for a fresh
# install. The migrate step pulls a partial HA backup of just the Scrypted
# add-on (via HA's Supervisor API) and seeds it into the VM, preserving your
# camera(s) and the HomeKit pairing (both hosts are amd64, so it's portable).
#
# HA_URL: your Home Assistant base URL (no trailing slash).
HA_URL=http://homeassistant.local:8123
# HA_TOKEN: a Home Assistant Long-Lived Access Token. Create one in HA:
#   profile (your user, bottom-left) -> Security -> Long-Lived Access Tokens
#   -> "Create Token". Paste it here. This is a SECRET — .env is gitignored, so
#   it never leaves your machine. Leave blank to skip migration.
HA_TOKEN=
# Add-on slug to migrate (default is the official Scrypted add-on). Override
# only if `ha addons` shows a different slug on your install.
# SCRYPTED_ADDON_SLUG=09e60fb6_scrypted